CVE-2024-54683

What it actually does

Race condition in netfilter IDLETIMER target allowing concurrent rule deletion (holding list_mutex) and sysfs file read, resulting in ABBA deadlock between list_mutex and kn->active lock.

Why it matters to the business

System hangs or kernel deadlocks on Linux hosts using IDLETIMER rules under concurrent management and monitoring workloads, leading to operational disruption. Low public exploit activity and no ransomware use reduce urgency but stability risk remains for affected environments.

How an attack unfolds

An attacker with local access to run iptables repeatedly adds and deletes an IDLETIMER rule in one loop while another process reads the corresponding sysfs timer file, triggering the locking dependency. Related threat actor activity centers on other kernel privilege-escalation CVEs rather than this deadlock.

How to fix it

Upgrade affected packages to the listed fixed versions including qemu (Ubuntu:14.04:LTS) at 2.0.0+dfsg-2ubuntu1.26. Apply the upstream kernel commit that releases list_mutex immediately after list deletion before continuing teardown.

How to confirm the fix worked

Confirm updated package versions match the provided fixed releases, then execute the supplied reproducer script while monitoring for lockdep warnings in dmesg.

Typical attack path

1. Gain local shell access on target Linux system
2. Execute concurrent loops performing iptables -A/-D on IDLETIMER rules and cat on /sys/class/xt_idletimer/timers/*
3. Trigger list_mutex vs kn->active lock inversion causing deadlock

How to detect it

Search kernel logs for lockdep warnings referencing list_mutex and __kernfs_remove during idletimer_tg_destroy_v operations; review audit logs for rapid repeated IDLETIMER rule additions and deletions.

What your security team should do

• Apply the referenced package updates on all systems using netfilter IDLETIMER
• Enable lockdep and monitor kernel logs for circular locking warnings involving idletimer_tg_destroy
• Limit unprivileged access to iptables and sysfs timer files where feasible